The harsh reality is that most organisations will have their security compromised
If they have not yet been hacked, then either they've been hacked and just don't know it yet, or they are still going to be hacked and living under a false sense of security